Exception for Application based on Certificate

[morris]

Hi,

we have some applications which are blocked by Harmony Endpoint. We are very sure, that its a false-positive.

The software is signed with a certificate by the developer.

Is there any configuration where we can whitelist all software which is signed by this certificate.

This behaviour mostly occurs after the software gets an update.

[lluner]

@morris 

Could you show the logs to know which blade is blocking?

[lluner]

this sk can help you sk181679 - Smart Exclusions - Syntax and Supported Capabilities for Exclusion Types

[morris]

Its Forensics and Threat Emulation

[lluner · Accepted solution]

@morris 

You can exclusions  it by right-clicking mouse  on it.

[morris]

That did the magic. thanks! 

But isn't that kinda unsecure somehow? You just paste the signer of the Certificate as a string.

I know from solutions like Cylance that you upload the certificate itself into the management portal. 

[lluner]

@morris 

Você pode testar e colocar esse problema de certificado na exclusão forense, não sei se vai funcionar? Por algum motivo, esse executável está alertando a lâmina TE